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SPECIFICATION AMENDMENTS 

(Replace third full paragraph on page 2 with the following paragraph.) The use of 
cryptographic key pairs was disclosed in U.S. Pat. No. 4,200,770, entitled "CRYPTOGRAPHIC 
APPARATUS AND METHOD." U.S. Pat. No. 4,200,770 also disclosed the application of key 
pairs to the problem of key agreement over an insecure communication channel. The algorithms 
specified in this U.S. Pat. No. 4 ,200,700 4.200.770 rely for their security on the difficulty of the 
mathematical problem of finding a discrete logarithm. U.S. Pat. No. 4,200,770 is hereby 
incorporated by reference into the specification of the present invention. 

(Replace the first full paragraph on page 7 with the following paragraph.) It is an object 
of the present invention to efficiently create a digital signature using a modulus p selected from 
the following families of equations: 

p=(2*-Z*-l)/r, 

where 0<2c<=d, where rf= does not equal to 1. and where GCD(c,cl)=l, where GCD is a 
function that returns the greatest common denominator between the variables in parenthesis; 

p=(2*-2r h '*+2> M *-...-?+l)/r. 

where d is even, and where k is not equal to 2 (mod 4); 
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p=(2 dk -T k .])/r, 

where 3d<6c<4d, and where GCD(c f d)=U 

p=(2 li '-2' k +])/r, 

where 0<2c<=4, where r/= does not equal to 1, and where GCD(c,d)=l\ and 

p=(2 4k -2' ik +2 2k +l)/r. 

(Replace the first full paragraph on page 8 with the following paragraph.) The first step 
through sixth step are done by each user who wishes to have its message digitally signed. The 
first step is selecting a modulus p from the following family of equations: 

p=(T*-2*-l)/r, 

where 0<2c<=c/, where r does not equal to 1, and where GCD(c,d)=l\ 
where d is even, and where k is not equal to 2 (mod 4); 
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p=(2 llk 'T k -l)/r, 

where 3d<6c<4cl, and where GCD(c,d)=l\ 

p=(2' !k -2 rk +l)/r t 

where 0<2c<=rf, where r /= does not equal to 1, and where GCD(c,d)=l \ and 

p=(2 4k -2 3k +2 2k +l)/r. 

(Replace the sixth full paragraph on page 9 with the following paragraph.) The seventh 
step through fifteenth step are done to identity the user who wishes to have a message digitally 

signed. The seventh step is a prover retrieving generating its private key w w and public key 
W =w G. and distributing its W . 

L £— ' * U 

(Replace the seventh full paragraph on page 9 with the following paragraph.) The eighth 
step is a verifier retrieving the prover's public key W W . 

(Replace the eighth full paragraph on page 9 with the following paragraph.) The ninth 
step is the prover generating a private integer k k . 
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(Replace the ninth full paragraph on page 9 with the following paragraph.) The tenth step 
is the prover combining kk^ and prover' 3 G to form K using the form of the prover' 3 modulus p. 

(Replace the twelfth full paragraph on page 9 with the following paragraph.) The 
thirteenth step is the prover combining c, k k , and w to form a response integer v. 

(Replace the fourteenth full paragraph on page 9 with the following paragraph.) The 
fifteenth step is the verifier combining cG, K, and W using the form of the prover' 3 modulus 

p and checking to see if the combination is equal to vG. If the combination is equal to vG then 
the prover is properly identified. Otherwise, the prover is not properly identified. 

(replace the fifteenth full paragraph on page 9 with the following paragraph.) The 
sixteenth step through the twenty-first step are done by the person digitally signing a message. 

The sixteenth step is a signer retrieving generating its private key w w s . 

(Replace the sixteenth full paragraph on page 9 with the following paragraph.) The 
seventeenth step is the signer generating a private integer k £ ? . 
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(Replace the seventeenth full paragraph on page 9 with the following paragraph.) The 
eighteenth step is the signer combining k k s and G to form K using the form of the provcr's 

modulus p. 

(Replace the second full paragraph on page 10 with the following paragraph.) The 
twentieth step is the signer combining /z, k k s , and w w_ s to form an integer s. 

(Replace the fourth full paragraph on page 10 with the following paragraph.) The twenty- 
second step through the twenty-fifth step are done by the person verifying the digital signature. 

The twenty-second step is the verifier retrieving the prover's public key WJV . 

(Replace the seventh full paragraph on page 10 with the following paragraph.) The 
twenty-fifth step is the verifier combining li, k K, and W using the form of the proverb 

modulus p and checking to see if the combination is equal to sG. If so, then the digital signature 
is verified. Otherwise, the digital signature is not verified. 

(Replace the eighth full paragraph on page 10 with the following paragraph.) The twenty- 
sixth step through the thirty-first step are alternative steps for digitally signing a message. The 

twenty-sixth step is a signer retrieving its private key w 
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(Replace the ninth full paragraph on page 10 with the following paragraph.) The twenty- 
seventh step is the signer generating a private integer * k s . 

(Replace the tenth full paragraph on page 10 with the following paragraph.) The twenty- 
eighth step is the signer combining k k s and G to form K using the form of the provcr's modulus 

P- 

(Replace the twelfth full paragraph on page 10 with the following paragraph.) The 
thirtieth step is the signer combining h, k k s , and w w s to form an integer s. 

(Replace the thirteenth full paragraph on page 10 with the following paragraph.) The 
thirty - second thirty-first step through thirty-sixth steps are alternative steps for verifying the dig- 
ital signature of the alternative signing steps. The thirty-first step is the signer sending the mes- 
sage M and the digital signature (h 9 s) of M. 

(Replace the fourteenth full paragraph on page 10 with the following paragraph.) The 
thirty-second step is the verifier retrieving the prover's public key WW. 
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(Replace the first full paragraph on page 1 1 with the following paragraph.) The thirty- 
fourth step is the verifier combining h, WW 9 and sG using the form of the provcr's modulus p to 

form K. 

(Replace the last paragraph on page 1 1 with the following paragraph.) The present 
invention is a method of identifying a user, generating a digital signature for a message of the 
user, and verifying the digital signature in an efficient manner (i.e., in fewer steps than the prior 
art) using a modulus p selected from the following family of equations: 



p=(2 ,tk -2 ,k -J)/r, 



where 0<2c<=</, where r /= does not equal 1, and where GCD(c,d)=l\ 



where d is even, and where k is not equal to 2 (mod 4); 



p=(2 ,lk 'T k -l)/r, 



where 3d<6c<4d, and where GCD(c,d)=l\ 



p=(2'' k -2 ik +J)/r, 
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where 0<2c<=rf, where r/= does not equal 1, and where GCD(c t d)~i\ and 



(Replace the last paragraph on page 13 with the following paragraph.) The first step 1 
the present method is selecting a modulus p from the following family of equations: 

p=(2 lik -2 ,k -l)/r, 

where 0<2c<=</, where r /= does not equal 1 , and where GCD( c,d)=l ; 

p-(2 -2 +2 ;..-2+l)/r, 

where is even, and where k is not equal to 2 (mod 4); 



p=(2*'Z*-lYr, 



where 3d<6c<4d 1 and where GCD(c t d)~^\ 



p=(2 tIk -2 tk +J)/r, 



where 0<2c<=<Y, where r /= does not equal 1, and where GCD(c,d)=i\ and 



p=(2"'-2*+2*+;yr. 
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(Replace the seventh full paragraph on page 14 with the following paragraph.) The 
seventh step 7 of the method is a prover retrieving generating its private key w and public key 

W -w G and dirstibuting W . 
~a — a D — £ 

(Replace the eighth full paragraph on page 14 with the following paragraph.) The eighth 
step 8 of the present method is a verifier retrieving the prover* s public key W W . 

(Replace the ninth full paragraph on page 14 with the following paragraph.) The ninth 
step 9 of the present method is the prover generating a private integer k k . 

(Replace the first full paragraph on page 15 with the following paragraph.) The tenth step 
10 of the present method is the prover combining k k p and prover' s G to form K using the form 

of the prover' s modulus p. 

(Replace the third full paragraph on page 15 with the following paragraph.) The twelfth 
step 12 of the present method is the verifier sending a challenge integer c to the prover. 
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(Replace the fourth full paragraph on page 15 with the following paragraph.) The 
thirteenth step 13 of the present method is the prover combining c, k k p , and w vv^ to form a 

response integer v. 

(Replace the sixth full paragraph on page 15 with the following paragraph.) The fifteenth 
step 1 5 of the present method is the verifier combining cG t K, and W JV using the form of the 

prover' s modulus p and checking to see if the combination is equal to vG. If the combination is 
equal to vG then the prover is properly identified. Otherwise, the prover is not properly 
identified. 

(Replace the eighth full paragraph on page 15 with the following paragraph.) The 
sixteenth step 16 of the present method is a signer retrieving its private key w w s . 

(Replace the ninth full paragraph on page 15 with the following paragraph.) The 
seventeenth step 17 of the present method is the signer generating a private integer * k s . 

(Replace the tenth full paragraph on page 15 with the following paragraph.) The 
eighteenth step 18 of the present method is the signer combining k fc^and G to form K using the 

form of the signer' s modulus /?. 
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(Replace the twelfth full paragraph on page 15 with the following paragraph.) The 
twentieth step 20 of the present method is the signer combining h, k k s , and w *Mo form an 

integer s. 

(Replace the second full paragraph on page 16 with the following paragraph.) The 
twenty-second step 22 of the present method is the verifier retrieving the prover's public key W 

W . 
—a 

(Replace the fifth full paragraph on page 16 with the following paragraph.) The twenty- 
filth step 25 of the present method is the verifier combining h % k K, and W using the form of 

the provcr'3 modulus p and checking to see if the combination is equal to sG, If so, then the 
digital signature is verified. Otherwise, the digital signature is not verified. 

(Replace the seventh full paragraph on page 16 with the following paragraph.) The 
twenty-sixth step 26 of the present method is a signer retrieving its private key w vv^. 

(Replace the eighth full paragraph on page 16 with the following paragraph.) The twenty- 
scvcnih step 27 of the present method is the signer generating a private integer* 
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(Replace the ninth full paragraph on page 16 with the following paragraph.) The twenty- 
eighth step 28 of the present method is the signer combining k k s and G to form K using the form 

of the s i gner's modulus p. 

(Replace the eleventh full paragraph on page 16 with the following paragraph.) The 
thirtieth step 30 of the present method is the signer combining //, k k s , and w w_ s to form an 

integers. 

(Replace the second full paragraph on page 17 with the following paragraph.) The thirty- 
second step 32 of the present method is the verifier retrieving the prover's public key WW^. 

(Replace the fourth full paragraph on page 17 with the following paragraph.) The thirty- 
fourth step 34 of the present method is the verifier combining h t WW^ and sG using the form of 

the prover's modulus p to form K. 

(Replace the first full paragraph on page 24 with the following paragraph.) A method of 
identifying user, generating digital signature, and verifying digital signature by selecting a 
modulus p in the form of p=(2 tlk -2 lk -l )/n p=(2 llk - 2* l *+7t* 2 \..-t+l)/n p=(Z*-2*-l )/n p=(Z*~ 
Z k +l)/r\ and p=(2 Jk -2 Jk +2 2k +l)/r\ selecting an elliptic curve E and an order q\ selecting a 
bascpoint G; generating a private key w; generating a public key W~wG\ distributing p. E, q, G, 
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and W to at least a prover. a verifier, and a signer ; retrieving generating a the prover's private key 
w w and public key W =w G\ retrieving the prover's public key WW: generating a private 

^ 12 U *- 

integer k k \ combining k k p and the prover's G to form K using the provcr'a modulua p; sending 
K to the verifier; sending a challenge integer c to the prover; combining c, k k p , and w w p to form 

a response integer v; sending v to the verifier; combining cG, K, and W using the provcr'a 
modulus p and checking to see if the combination is equal to vGAf not so, stop. Otherwise, 
retrieving generating, bv the signer, the signer's private key w v^; generating a private integer k 

k ; combining k k and G to form K using the prover' 3 modulua p\ combining K and a message M 

to form an integer h\ combining h, k k s , and w w & to form an integer s\ sending M and (K,s) as a 

digital signature of M; retrieving the provcr'a public kcy WW g ; receiving M and (K,s)\ combining 

K and M to form an integer h; and combining h, k K, and W using the provcr'a modulu a p and 
checking to see if the combination is equal to sG. If so, the digital signature is verified. 
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